Add X509V3_set_issuer_pkey, needed for AKID of self-issued not self-signed cert

Also clean up some related auxiliary functions and documentation

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13658)

2 files changed, 43 insertions, 14 deletions

diff --git a/test/recipes/25-test_req.t b/test/recipes/25-test_req.t
index cb9f8888a5..7f699c065d 100644
--- a/test/recipes/25-test_req.t
+++ b/test/recipes/25-test_req.t
@@ -15,9 +15,9 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
 
 setup("test_req");
 
-plan tests => 39;
+plan tests => 38;
 
-require_ok(srctop_file('test','recipes','tconversion.pl'));
+require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
 
 my @certs = qw(test certs);
 
@@ -259,7 +259,7 @@ sub generate_cert {
     my $cn = $is_ca ? "CA" : "EE";
     my $ca_key = srctop_file(@certs, "ca-key.pem");
     my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
-    my @cmd = ("openssl", "req", "-config", "\"\"","-x509",
+    my @cmd = ("openssl", "req", "-config", "\"\"", "-x509",
                "-key", $key, "-subj", "/CN=$cn", @_, "-out", $cert);
     push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
     ok(run(app([@cmd])), "generate $cert");
@@ -286,10 +286,10 @@ sub strict_verify {
 
 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
              "-addext", "keyUsage = keyCertSign");
+my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
 my $cert = "self-signed_v1_CA_no_KIDs.pem";
 generate_cert($cert);
-has_SKID($ca_cert, 0);
-has_AKID($ca_cert, 0);
+cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
 
 $ca_cert = "self-signed_v3_CA_default_SKID.pem";
@@ -300,15 +300,13 @@ strict_verify($ca_cert, 1);
 
 $cert = "self-signed_v3_CA_no_SKID.pem";
 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
-has_SKID($cert, 0);
-has_AKID($cert, 0);
+cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 #TODO strict_verify($cert, 0);
 
 $cert = "self-signed_v3_CA_both_KIDs.pem";
 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash",
             "-addext", "authorityKeyIdentifier = keyid");
-has_SKID($cert, 1);
-has_AKID($cert, 1);
+cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # SKID == AKID
 strict_verify($cert, 1);
 
 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
@@ -317,8 +315,7 @@ generate_cert($cert, "-addext", "keyUsage = keyCertSign");
 
 $cert = "v3_EE_default_KIDs.pem";
 generate_cert($cert, "-addext", "keyUsage = dataEncipherment");
-has_SKID($cert, 1);
-has_AKID($cert, 1);
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 strict_verify($cert, 1, $ca_cert);
 
 $cert = "v3_EE_no_AKID.pem";
@@ -326,3 +323,9 @@ generate_cert($cert, "-addext", "authorityKeyIdentifier = none");
 has_SKID($cert, 1);
 has_AKID($cert, 0);
 strict_verify($cert, 0, $ca_cert);
+
+$cert = "self-issued_v3_EE_default_KIDs.pem";
+generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
+    "-in", srctop_file(@certs, "x509-check.csr"));
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+strict_verify($cert, 1);
diff --git a/test/recipes/tconversion.pl b/test/recipes/tconversion.pl
index bf096994e3..6ae5cf17ea 100644
--- a/test/recipes/tconversion.pl
+++ b/test/recipes/tconversion.pl
@@ -111,8 +111,8 @@ sub cmp_text {
 sub file_contains {
     $_ = shift @_;
     my $pattern = shift @_;
-    open(DATA,$_) or return 0;
-    $_= join('',<DATA>);
+    open(DATA, $_) or return 0;
+    $_= join('', <DATA>);
     close(DATA);
     return m/$pattern/ ? 1 : 0;
 }
@@ -122,11 +122,37 @@ sub cert_contains {
     my $pattern = shift @_;
     my $expected = shift @_;
     my $name = shift @_;
-    my $out = "tmp.out";
+    my $out = "cert_contains.out";
     run(app(["openssl", "x509", "-noout", "-text", "-in", $cert, "-out", $out]));
     is(file_contains($out, $pattern), $expected, ($name ? "$name: " : "").
        "$cert should ".($expected ? "" : "not ")."contain $pattern");
     # not unlinking $out
 }
 
+sub uniq (@) {
+    my %seen = ();
+    grep { not $seen{$_}++ } @_;
+}
+
+sub file_n_different_lines {
+    my $filename = shift @_;
+    open(DATA, $filename) or return 0;
+    chomp(my @lines = <DATA>);
+    close(DATA);
+    return scalar(uniq @lines);
+}
+
+sub cert_ext_has_n_different_lines {
+    my $cert = shift @_;
+    my $expected = shift @_;
+    my $exts = shift @_;
+    my $name = shift @_;
+    my $out = "cert_n_different_exts.out";
+    run(app(["openssl", "x509", "-noout", "-ext", $exts,
+             "-in", $cert, "-out", $out]));
+    is(file_n_different_lines($out), $expected, ($name ? "$name: " : "").
+       "$cert '$exts' output should contain $expected different lines");
+    # not unlinking $out
+}
+
 1;